<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><tt>Hi Ed,</tt></p>
<p><tt>Please find my responses </tt><tt><br>
</tt></p>
<p><tt>Ratan</tt><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 25/02/19 10:42 PM, Tanous, Ed wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7E9441B1E5EFFD4681F54958E8216993459FE05D@ORSMSX114.amr.corp.intel.com">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
Hi Ed,
This mail is regarding the authorization support on Redfish.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Thanks for pushing forward on this. I think the best first step would be to review the patchset that's already in progress that's adding some infrastructure to do a lot of the things you're proposing. If you're proposing an alternative approach than the existing review, and I misunderstood, apologies.
<a class="moz-txt-link-freetext" href="https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/15813">https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/15813</a>
I suspect the questions we need to answer are:
1. How do we determine a user's role?</pre>
</blockquote>
<tt><b>we can get the user role/privilege by calling the D-bus
method on phosphor-user-manager.</b></tt>
<p><tt><b>Gerrit commit is up for the same.</b></tt></p>
<p><b><tt><a class="moz-txt-link-freetext" href="https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-user-manager/+/18132/">https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-user-manager/+/18132/</a><br>
</tt></b></p>
<blockquote type="cite"
cite="mid:7E9441B1E5EFFD4681F54958E8216993459FE05D@ORSMSX114.amr.corp.intel.com">
<pre class="moz-quote-pre" wrap="">
2. Given that privilege is required to service every request, do we need to cache it, or can we go to dbus for every request?</pre>
</blockquote>
<tt>Once we get the user role/privilege, we will add the user role
in the session object itself</tt><tt><br>
</tt>
<p><tt>during creation of the session so no need to make D-bus call
for every request.</tt></p>
<blockquote type="cite"
cite="mid:7E9441B1E5EFFD4681F54958E8216993459FE05D@ORSMSX114.amr.corp.intel.com">
<pre class="moz-quote-pre" wrap="">
3. How is the cache invalidated?</pre>
</blockquote>
<tt>Session would be invalidated during logout or session timeout</tt>.<br>
<blockquote type="cite"
cite="mid:7E9441B1E5EFFD4681F54958E8216993459FE05D@ORSMSX114.amr.corp.intel.com">
<pre class="moz-quote-pre" wrap="">
I think the bulk of the implementation will be filling out the method here:
<a class="moz-txt-link-freetext" href="https://github.com/openbmc/bmcweb/blob/a24526dcf9ad8de2f0bd9dbd5fc746a130351a22/redfish-core/include/privileges.hpp#L229">https://github.com/openbmc/bmcweb/blob/a24526dcf9ad8de2f0bd9dbd5fc746a130351a22/redfish-core/include/privileges.hpp#L229</a>
And moving roles away from the static implementation, as you've already determined.
Do you have any intention to implement PrivilegeRegistry?</pre>
</blockquote>
<tt>No, the intention is to call the get User Info function and add
the User role into the session, so for each HTTP request we know
the user privilege and compare it with the entity privilege.</tt><br>
<blockquote type="cite"
cite="mid:7E9441B1E5EFFD4681F54958E8216993459FE05D@ORSMSX114.amr.corp.intel.com">
<pre class="moz-quote-pre" wrap="">
Looking forward to seeing your work here.
-Ed
</pre>
</blockquote>
</body>
</html>